jspreadsheet / jspreadsheet/ce
eval() used for formula dependency-token type checking in index.js (bundler flags it, and it's built from parsed formula tokens)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 7.2k
- Forks
- 890
- PR merge metrics
- No merged PRs in 30d
Description
Version: 5.0.4 (node_modules/jspreadsheet-ce/dist/index.js)
Description:
The formula dependency tracker uses a direct eval() call built from string concatenation of a parsed formula token:
// dist/index.js:571
for (let i = 0; i < tokens.length; i++)
if (
obj.formula[tokens[i]] || (obj.formula[tokens[i]] = []),
obj.formula[tokens[i]].indexOf(parentId) < 0 && obj.formula[tokens[i]].push(parentId),
eval("typeof(" + tokens[i] + ") == \"undefined\"")
) {
Modern bundlers (Vite/Rollup in my case) flag this explicitly:
[EVAL] Use of direct `eval` function is strongly discouraged as it poses security risks and may cause issues with minification.
Reproduction: any Vite (or other Rollup-based) build of a project depending on jspreadsheet-ce with formula support in use will surface this warning at build time, pointing at this exact line.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at node_modules/jspreadsheet-ce/dist/index.js around line 571, where formula dependency tokens are type-checked with eval(). Reproduce the Vite or Rollup build described in the issue and trace the surrounding formula dependency logic. Done means the bundler warning is gone while formula support and dependency tracking still work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100